Populate server name from source field

indeed_2000 — Tue, 29 Jun 2021 18:04:16 GMT

here is my dashboard, i want to populate server name in dashboard.

i create token to get server name from source file, here is the source file

/data/product/customer/20210622/log.SRV21.20210622.bz2"

/data/product2/customer2/20210622/log.SRVdata21.20210622.bz2"

…

<label>dashboard</label>

</default>

</input>

<label>Server Name</label>

<fieldForLabel>rexOutput</fieldForLabel>

<fieldForValue>rexOutput</fieldForValue>

<query>| metadata type=sources index=main | rex field=source "(\/\w+){4}\/(?<rexOutput>\w+.\w*)\S+" |search rexOutput=$tokserver$ | dedup rexOutput | table rexOutput</query>

</search>

</input>

<label>Signal</label>

<fieldForLabel>signal</fieldForLabel>

<fieldForValue>signal</fieldForValue>

<query>index="main" signal | search signal=$toksig$ | table _time Modules signal</query>

</search>

</input>

</fieldset>

<row>

<panel>

<query>index="main" signal | search source=$tokserver$ | search signal=$toksig$ | table _time Modules signal</query>

<earliest>$tokTime.earliest$</earliest>

<latest>$tokTime.latest$</latest>

</search>

<option name="timeline_app.timeline.axisTimeFormat">MINUTES</option>

<option name="timeline_app.timeline.colorMode">categorical</option>

<option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>

<option name="trellis.size">medium</option>

</viz>

</panel>

</row>

</form>

Re: Populate server name from source field

venkatasri — Wed, 30 Jun 2021 01:57:18 GMT

Hi @indeed_2000 can you update your query,

| metadata type=sources index=main | rex field=source "(\/\w+){4}\/(?<rexOutput>\w+.\w*)\S+" | dedup rexOutput | fields rexOutput

---

An upvote would be appreciated and Accept solution if it helps!

Re: Populate server name from source field

venkatasri — Wed, 30 Jun 2021 02:09:39 GMT

You have to to do one more update to multiselect token,

<prefix>(</prefix> <suffix>)</suffix> <valuePrefix>source="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter>

Change the following query to -

index="main" signal $tokserver$ | search signal=$toksig$ | table _time Modules

Re: Populate server name from source field

venkatasri — Wed, 30 Jun 2021 02:10:37 GMT

@indeed_2000 total 3 changes to dashboard.

An upvote would be appreciated and Accept the solution if it helps!

topic Populate server name from source field in Dashboards & Visualizations

Populate server name from source field

Re: Populate server name from source field

Re: Populate server name from source field

Re: Populate server name from source field